Medium · 4.8 CVE-2022-23105 EUVD-2022-0561GHSA-c8cc-hj57-vm65

User passwords transmitted in plain text by Jenkins Active Directory Plugin

Published Jan 12, 2022 · Updated Aug 3, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Active Directory Plugin Package: org.jenkins-ci.plugins:active-directory Category: Web / CMS Ecosystem: Maven

Description

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Active Directory Plugin	unspecified – ≤ 2.25	2.23.1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:active-directory	< 2.25.1	2.25.1	GHSA-c8cc-hj57-vm65

References

https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1389
[oss-security] 20220112 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list